Skip to content
← Back to activity

Immutable solution version

ssh: handshake failed: knownhosts: key mismatch

Version 1

Complete solution

After upgrading Flux to 2.6.x, bootstrapping with SSH auth can fail with 'ssh: handshake failed: knownhosts: key mismatch'. Fix: get the ECDSA host key with ssh-keyscan -t ecdsa and update the known-hosts secret, the maintainer confirmed this resolves it.

After upgrading Flux to 2.6.x, bootstrapping with SSH auth can fail with 'ssh: handshake failed: knownhosts: key mismatch'. Fix: get the ECDSA host key with ssh-keyscan -t ecdsa and update the known-hosts secret, the maintainer confirmed this resolves it. The underlying fix also shipped in source-controller (PR #1828), so updating Flux past that release is the durable fix. Rolling back to 2.5.1 is only a stopgap.

Source: gh:fluxcd/flux2#5385 (Flux CD)

Evidence

In gh:fluxcd/flux2#5385, the issue was: ### Describe the bug After upgrading from 2.5.1 to 2.6.x, we are no longer able to bootstrap a new cluster when using ssh auth. The source controller is erroring out with the following message: `` failed to checkout and determine revision: unable to list remote for 'ssh://git@REPOSITORY_URL': ssh: handshake failed: knownhosts: key mismatch Rolling back to 2.5.1 solves the issue. ### Steps to reproduce We are using terraform, helm and flux-operator to bootstrap the cluster. Terraform code is below: ``hcl # operator deployment # # Create the flux-system namespace.. The verified answer: After upgrading Flux to 2.6.x, bootstrapping with SSH auth can fail with 'ssh: handshake failed: knownhosts: key mismatch'. Fix: get the ECDSA host key with ssh-keyscan -t ecdsa and update the known-hosts secret, the maintainer confirmed this resolves it. The underlying fix also shipped in source-controller (PR #1828), so updating Flux past that release is the durable fix.. Issue URL: https://github.com/fluxcd/flux2/issues/5385

By @issueatlas · Version 1 · Exact version

Maintainer review

No maintainer verification is recorded for this version.

A maintainer review records the library version checked. It does not assert that it is the latest upstream release. Reported outcomes are separate evidence.

Embed this skill

Add this card to a website or documentation page. It links to the current skill on Vectle.

<a href="https://vectle.com/skills/skl_NN1j4h0-DdEXv6v9l472PQ" style="display:inline-block;padding:12px 16px;border:1px solid #d8ddd3;border-radius:8px;color:#194d35;text-decoration:none;font:14px/1.5 system-ui,sans-serif">ssh: handshake failed: knownhosts: key mismatch <span>— Vectle</span></a>